ShipLatch MCP Server

by shiplatch Your server? Claim it

answering

ShipLatch is answering right now. Last checked 5 min ago. It exposes 3 tools.

Free passive security scan for AI-built apps: leaked API keys, public .env files, security headers

Uptime history 12 days of history

12 days agonow

100.0%

Uptime 24h

92 of 92 checks

Tools

read from the server

257 ms

Response time

average over 24h

open, no key

Access

streamable-http

Nothing serious here today

Today is the operative word: we check ShipLatch every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 5 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add scanner --transport http https://shiplatch.com/mcp

Settings → Connectors → Add custom connector, then paste this address

https://shiplatch.com/mcp

~/.codex/config.toml

[mcp_servers.scanner]
url = "https://shiplatch.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "scanner": {
      "url": "https://shiplatch.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "scanner": {
      "type": "http",
      "url": "https://shiplatch.com/mcp"
    }
  }
}

Available tools 3

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

scan

get_scan

Get the free summary of a ShipLatch scan by its scan_ref (from scan_url). Use it when scan_url returned status "running". Results are kept for 7 days.

scan_url

Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status "running" and a scan_ref: call get_scan with it.

checks

list_checks

List the categories of security checks ShipLatch runs, which are in the free passive scan and which need ownership verification. No network access.

Endpoints

URL	Transport	State	Latency	Checked
https://shiplatch.com/mcp	streamable-http	answering	132 ms	5 min ago

Alternatives to ShipLatch

same job, measured the same way

Vibescan

by bigfloppy-vibescan

Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.

1 tools answering

Tuvio

by tuvio

Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.

answering

Wardzo

by wardzo

Scan and monitor websites for leaked keys, exposed files, security headers, SEO issues and uptime.

12 tools answering

Secret Scanner

by guardbee

Scans files for leaked secrets and API keys

762 installs/wk local only

Secret Scanner

by 4hmetuyar

Scans files for leaked secrets and API keys

local only

Arbiter

by arbiterscan

Security checks for apps built with AI: leaked keys, open routes, database rules, each with a fix.

answering

Passiv Web Tools

by mahope

Free web tools for AI agents: HTML to Markdown, compliance scan, page profile, security headers.

local only

Nel Veil

by nelproinc

Free passive security scanning - check any domain's DMARC, TLS, headers, and exposures.

88 installs/wk local only

ShipLatch — questions

Answers built from our own checks of this server.

What can ShipLatch do?

It exposes 3 tools, read directly from the server on our last check. Among them: get_scan, list_checks, scan_url. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is ShipLatch working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 257 ms. The bar chart above shows every period we have measured.

How do I connect ShipLatch?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does ShipLatch need an API key?

No. ShipLatch completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 3 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is ShipLatch?

It answers our handshake in 257 ms on average, which is faster than 55% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.